Philippines Country-Specific Exhibit

Effective Date: February 3, 2026

Last Updated: February 3, 2026

Global Privacy Policy – Philippines Country-Specific Exhibit

This exhibit (“Exhibit”) supplements our Global Privacy Policy and applies specifically to individuals who reside in or access our Services from the Philippines. This provides additional or modified terms that reflect local legal requirements and practices. To the extent that any provisions in this exhibit conflict with the Global Privacy Policy, the terms of this Exhibit will govern for users within the applicable area. Please read this Exhibit together with the Global Privacy Policy to understand how we handle your personal information.

1. Privacy Statement

This Exhibit is adopted in compliance with Republic Act No. 10173 or the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations (“IRR”), and other relevant policies, including issuances of the National Privacy Commission (“NPC”). We respect and value your data privacy rights and make sure that all personal data collected from you are processed in adherence to the general principles of transparency, legitimate purpose, and proportionality.

This Exhibit shall inform you of our data protection and security measures, and may serve as your guide in exercising your rights under the DPA.

2. Definition of Terms

Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

Sensitive personal information refers to personal information:

1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
4. Specifically established by an executive order or an act of Congress to be kept classified.

3. Processing of Personal Information

(1) Legal Basis

Global Edge Careers will process personal information on the basis of lawful criteria as provided under the DPA and other relevant laws.

Generally, Global Edge Careers shall rely on legitimate interests or the fulfilment of our contract with you, depending on the nature of our relationship, as our primary legal basis for the collection, use, storage, disclosure, or other processing of your personal information.

In addition to the foregoing lawful criteria, or where the law specifically requires it, Global Edge Careers may, in some cases, obtain your consent in a manner consistent with the standards set by applicable laws.

(2) Notice and Consent

In the event that your personal information will be used for purposes other than those disclosed in the policy, you will be notified of such additional use in accordance with requirements under relevant laws and regulations.

Where applicable, your consent will be obtained and shall be evidenced by written, electronic, or recorded means. Consent may also be given on your behalf by a lawful representative or an agent you authorized.

(3) Retention

Global Edge Careers will retain your personal information only for such period as required to provide the Services and until the expiration of the applicable retention periods under: (a) as required for the performance of the Services; (b) our contractual obligations; (c) as required under applicable law; (d) for the enforcement or defence any rights or claims; and (e) industry standards, and sector specific laws and regulations, whichever comes later.

(4) Access

Due to the sensitive and confidential nature of the personal information under our custody, only authorized personnel shall be allowed to access such personal data, for any purpose, except as otherwise provided by law.

(5) Disclosure and Sharing of Personal Information to Third Parties

Disclosure and sharing of personal information to third parties shall, in each case, be pursuant to a legal justification provided under relevant law, which may include consent, legitimate purpose, or legal obligation. You will be notified of the disclosure, prior to such sharing or at the next practical opportunity, which should include the following information:

• Categories of recipients of the personal data, provided that the identity of the recipients may also be given upon request;
• Purpose of data sharing and the objective/s it is meant to achieve;
• Categories of personal information that will be shared;
• Existence of your rights; and
• Other information that would sufficiently inform you of the nature and extent of data sharing and the manner of processing involved.

4. Organization Security Measures

(1) Data Protection Officer

Global Edge Careers will designate a Data Protection Officer (“DPO”) to oversee its data protection responsibilities.

The DPO shall oversee the compliance of the organization with the DPA, its IRR, and other related policies, including the implementation of security measures, security incident and data breach protocol, and the inquiry and complaints procedure.

(2) Conduct of Privacy Impact Assessment or other risk-assessment measures

Global Edge Careers may conduct a Privacy Impact Assessment or other suitable risk-assessment measures relative to all activities, projects and systems involving the processing of personal data.

5. Breach and Security Incidents

(1) Data Privacy Response

• A Data Privacy Response Team (“Team”), which shall be responsible for ensuring immediate action in the event of a security incident or personal data breach, shall be constituted.
• The head of the Team shall inform the management of the need to notify the NPC and the data subjects affected by the incident or breach within the period prescribed by law.
• The Team shall prepare a detailed documentation of every incident or breach encountered, as well as an annual report, to be submitted to management and the NPC, within the prescribed period.

6. Inquiries and Complaints

You may exercise your rights, make an inquiry, or request for information regarding any matter relating to the processing of your personal data under our custody by sending an email via our Inquiry Form.

Inquiries via email: Inquiry Form